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(U) Topic: Iran - Current Topics, Interaction with GCHQ 

(U) Director’s Talking Points : 

• (TS//SI//REL TO USA, FVEY) Emphasize that we have successfully worked 
multiple high-priority surges with GCHQ that have allowed us to refine 
maintaining mission continuity and seamless transition, and maximize our target 
coverage. These jointly-worked events include the storming of the British 
Embassy in Tehran, Iran’s discovery of FLAME, and support to policymakers 
during the multiple rounds of P5 plus 1 negotiations. 

(U//FOUO) SIGINT Dir ector’s Talking Points : 

• (TS//SI//REL TO USA, FVEY) Note that our posture on Iran will serve us well 
going into any crisis or Event, but we still are taking a broader look at Iran, in die 
context of a possible crisis. This year we have updated contingency plans with 
GCHQ to reflect die changes in our access and Iran's capabilities. 

(U) Background: 

(TS//SI//REL TO USA, FVEY) NS A has seen Iran further extending its influence across 
the Middle East over the last year. 

1. (TS//SI//REL TO USA, FVEY) Iranian Cyber' Attacks: Iran continues to conduct 
distributed denial-of -service (DDOS) attacks against numerous U.S. financial institutions, 
and is currently in the third phase of a series of such attacks diat began in August 2012. 
SIGINT indicates that these attacks are in retaliation to Western activities against Iran’s 
nuclear sector and that senior officials in the Iranian government are aware of these 
attacks. NS A expects Iran will continue this series of attacks, which it views as 
successful, while striving for increased effectiveness by adapting its tactics and 
techniques to circumvent victim mitigation attempts. 

(TS//SI//REL TO USA, FVEY) Iran’s destructive cyber attack against Saudi Aramco in 
August 2012, during which data was destroyed on tens of thousands of computers, was 
the first such attack NSA has observed from this adversary. Iran, having been a victim of 
a similar cyber attack against its own oil industry in April 2012, has demonstrated a clear 
ability to learn from the capabilities and actions of others. While NSA has no indications 
at this time that Iran plans to conduct such an attack against a U.S. or UK target, we 
cannot rule out the possibility of such an attack, especially in the face of increased 
international pressure on the regime. 

2. (TS//SI//REL TO USA, FVEY) Iran Crisis Contingency Planning: NSA’s posture on 
Iran will serve us well going into any crisis or event. We continually update contingency 
plans to reflect the changes in both our access and Iran’s capabilities. 

• (TS//REL TO USA, FVEY) NSA’s crisis and event plans have been coordinated 
throughout the U.S. IC and are designed to sync with plans at CENTCOM, 
EUCOM and CYBERCOM. 
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• (TS//REL TO USA, FVEY) NSA’s planned battle rhythm focuses on production 
deadlines that will feed daily briefings and intelligence requirements for policy 
makers and Combatant Commands. 

• (TS//REL imJSA, FVEY) ME As Iran Division has held one VTC with GCHQ's 
Iran lead,^^^^^| and his team, with another scheduled for 23 April to discuss 
ongoing contingency planning efforts on both sides. 

(TS//SI//REL TO USA, FVEY) NSAhas successfully worked multiple high-priority 
surges with GCHQ that have allowed us to refine maintaining mission continuity and 
seamless transition, and maximize our target coverage. These jointly worked events 
include the storming of the British Embassy in Tehran; Iran's discovery of computer 
network exploitation tools on their networks in 2012 and 2013; and support to 
policymakers during the multiple rounds of PS plus 1 negotiation on Iran’s nuclear 
program. 

3. (TS//SI//REL TO USA, GBR) NSA-GCHQ-ISNU Unilateral Discussions: In January 
2013, during an NSA-ISNU analytic workshop on Iranian Leadership, the first ever 
trilateral VTC on an Iranian issue was held with NS A, GCHQ and ISNU participant^ 
The focus of the trilateral effort, which was kicked off by the VTC, is the pUmi 

The respective NSA-ISNU and GCHQ-ISNU 
bilateral relationships had gotten to the point that each participant recognized the need for 
the trilateral engagem ent to advan ce this specific topic. The trilateral relationship is 
limited to the topic of^^^^^^and will serve as a proof of concept of this kind of 
engagement. 

(U) Potential Landmine: 

• (TS//SI//NF) GCHQ has long advocated that it work with NSA and the ISNU in a 
trilateral arrangement to prosecute the Iranian target. SID policy has been opposed 
to such a blanket arrangement, and this specific trilateral should not be interpreted 
as a broad change of approach. In other areas, NSA and GCHQ have agreed to 
continue to share information gleaned from the respective bilateral relationships 
with ISNU. 
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